So you think you can drive? Or OSINT?

What makes a good driver?

Remember when you first received your drivers license? It doesn't matter if you got it with six hours of practice or 60+ hours of actual driving lessons - you could have not considered yourself a good driver at that moment. And you probably weren't.

The following 10 years you took your car to work and back every day and then had the occasional trip to go shopping or visit other places. Are you a good driver now? Well, definitely better than as a young kid, but let's be honest: Everyday driving doesn't necessarily make you a skilled or capable driver. At least not on the level of a professional like a race car driver. Depending on where and how you drove, it might actually be really obvious that you aren't cut out to drive well in all situations. Live in the desert and have never seen one flake of snow? Chances are, you're screwed when it comes to driving in the snow. Live on the country side and then have to drive narrow alleys in Napoli (Italy) and reverse parallel park. I'm sure you'll regret the day you did that without any practice. Never had to emergency brake and evade a moving obstacle? No wonder you hit that dear.

OSINT - Everyone is doing it!

Now you might ask yourself where I'm going with this. This answer is simple: replace the driving skills with your OSINT skills and it will make perfect sense. So you just took your first OSINT course and feel like you can investigate anything successfully? Think again, because it doesn't matter if the course was 3 hours or 5 days - you have the basic knowledge, but let's face it: you probably still suck at it. The reason being, you don't necessarily learn expert intelligence analysis, critical thinking or where to actually find what you're looking for in those brief courses. These skills are obtained and trained while conducting live research. A lot of research.

Some of you might be familiar with the 10.000 hour rule. This was a recurring topic in the book Outliers: The Story of Success written by Malcolm Gladwell. Gladwell argues that in order to achieve true expertise in any skill you must simply practice, albeit in the correct way, for at least 10.000 hours. 10.000 hours of actual live research - let me break that down for you:

OSINT Analyst No.1 finished his OSINT course and starts working at a company conducting due diligence checks solely using compliance tools such as LexisNexis or Orbis. His job consists of looking up companies and individuals in the same databases every single day and finding out if any red flags are listed in these databases. So technically, we can assume this person is "practicing" eight hours a day, works 220 days a year - so after five to six years he will be an expert. Now, here's why this math just won't work. First off, no one sits there eight hours a day doing exactly this research - on average we tend to be productive quite a bit less than that. Secondly, is this simple and repetitive task really something that trains your mind on intelligence analysis? Read the first sentence of this paragraph again. This person merely looks up things in a database - no additional research, no search engines, no checks on social media. So if someone just sits there and feeds a tool with queries, how can he possibly get better at critical thinking, intelligence analysis or be creative enough to think outside of the box and find information beyond those databases. The truth is: he won't. Not after 10.000 hours of doing the same structured and repetitive job., not after 20.000 hours and probably never.

OSINT analyst No. 2 has also completed an OSINT course and starts working as a high-level intelligence analyst in law enforcement. Everyday day she is confronted with different cases. Missing people, fake online shops, support on murder investigations, support on multinational corporate tax fraud cases. In short - she has to adapt to a different situation each and every day, as no case is like the other. I would argue that this young woman might not even need the 10.000 hours of practice, because she is constantly challenged with new techniques, new methods and cannot just sit back and relax. This, ladies and gentleman, is what makes an OSINT analyst become an expert OSINTer - constant practice on a very diverse array of different cases. This brings out her creativity, enhances her critical thinking skills and bolsters her intelligence analysis expertise in a way that OSINT analyst No. 1 can only dream of. But let's get serious again for a moment. How many of us are blessed with such an amazing job? A job that enables us to conduct SOCMINT-research, geolocate things and map them out with GEOINT, perform deep dives into the technical infrastructure of a domain or company, unravel the hierarchy of multinational companies with hundreds of subsidiaries, monitor terrorists across Telegram channels?

The Path to OSINT Mastery

Most OSINTers might not end up with such a dream job. We'll be stuck in our 9-to-5, often repeating the same thing over and over again. Querying the same tool over and over again, relying on AI more and more to do our job. Thus lacking the chance to actually get better. Regarding the over exaggerated use of AI, my buddy Nico Dekens (Dutch_OsintGuy) wrote a great article on that just recently.

If you are stuck in this situation yourself and lack the chance to improve your skills, ask yourself what you can do to achieve OSINT mastery through practice. You could read yet another OSINT book. You could participate one of my five day OSINT courses or any other OSINT course out there. Once more, I'll be honest: this will give roughly 40 hours on your 10.000 hours. It's a good start, but far from actually making you truly better. Practice is the key and if you can't practice diverse research scenarios at work, you'll have to do so at home. Keep your eyes and ears open and you'll come across plenty of topics to research. Let me give you some examples from my recent "practice sessions":

• The other day I was wondering if I could find a social media profile of my first real girlfriend. 30 years have passed and all I had was her maiden name. This took hours of SOCMINT, looking into profiles from our hometown and trying to find her. In the end, I was successful, despite her having changed last names twice through marriage. Borderline stalking, but I won't do anything with this information - not publish it, not get in contact with her, nothing. I did, however, freshen up my Facebook and Instagram skills along the way.
• There's an OSINT company that used to be Russian and now claims otherwise. I spent hours looking into the company registers of various countries, hunting down job ads of the company in Russian for Russians and putting together an overview of employees and their backgrounds from several career social media platforms. Turns out, the company is still registered in Russia, roughly 75% of their public employees are Russian, some likely still on a Russian work contract. A great exercise to dive into corporate reconnaissance.
• Reading up on the Doppelgänger campaign had me delve into the websites linked to this propaganda offensive. I had to look into things that I normally wouldn't - Whois and DNS, website attribution, backlinks - loads of technical stuff for a non-tech guy. While I wouldn't consider myself an expert on the topic of "technical OSINT", each and every little practice session gets me closer to it.
• Diving into AI to analyze foreign language X accounts of Iranian hackers after scraping them. Yes, AI was massively useful here and I learned a lot on how to use it - but I also learned not to fully trust it. In this case, it guided me in the right direction but I still had to sift through lots of material in a more manual approach in order not to miss out on small, but highly relevant, bits of information.

All of this can be considered a hobby, but can enable you to be quite proficient at what you do. Can you prove this proficiency with some kind of certificate? While there are certificates out there that include a basic knowledge of OSINT, I do believe that none of them will showcase expertise in intelligence analysis, critical thinking or creative research methods. So, dear companies or government agencies: once you have selected a couple of suitable job candidates, don't forget to test their actual skills.

As for me: my wife is always complaining when I'm in "OSINT mode" at home. I sat down and tracked how much time I spend with this outside my job. Turns out, it's roughly 10 hours a week. That's not even 1.5 hours a day. Perfectly fine for a hobby, keeps me away from the TV or PlayStation in any case

10 hours a weeks, approx. 50 weeks a year, 20 years of doing so = 10.000 hours of OSINT practice. Maybe add a couple of years and hours more through previous jobs. And still I haven't learned everything there is and cannot and will not stop practicing new methods and techniques. That my friends is how you achieve true OSINT mastery and maintain it.